Access Control Vulnerability in Nextcloud Deck by Nextcloud
CVE-2020-8235

4.3MEDIUM

Key Information:

Vendor

Nextcloud
Status
Nextcloud Deck App
Vendor
CVE Published:
5 October 2020

What is CVE-2020-8235?

Nextcloud Deck version 1.0.4 is impacted by a vulnerability due to missing access control, which exposes an insecure direct object reference. This flaw allows an attacker to unauthorizedly access and view all attachments associated with the tasks in Nextcloud Deck, potentially compromising sensitive information shared among users. It is essential for users of this platform to take precautionary measures to safeguard against potential exploits.

Affected Version(s)

Nextcloud Deck app Fixed in 1.0.5

References

https://hackerone.com/reports/916704
x_refsource_MISC
https://nextcloud.com/security/advisory/?id=NC-SA-2020-036
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.